topic Re: Policies at risk - how to accept these? in Cortex XDR Discussions

Policies at risk - how to accept these?

RFeyertag — Sun, 17 Dec 2023 19:24:28 GMT

Hello dear all!

How can I accept the risk of policies, which would be needed somewhere in the future?

I do not want to delete them. Just accept the risk.

Rob

Re: Policies at risk - how to accept these?

nsinghvirk — Tue, 19 Dec 2023 16:53:20 GMT

Hello @RFeyertag

Thanks for reaching out on Live Community!

Risky prevention policy notifications are in the form of warning badges and labels. XDR identifies risky prevention policies based on Palo Alto Networks best-practice policy settings.

Currently these are mere notifications and cannot be used for risk acceptance. You can use them in order to fine tune your prevention policies.

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

Re: Policies at risk - how to accept these?

tlmarques — Tue, 19 Dec 2023 19:02:19 GMT

Hi @RFeyertag

I would like to inform you that since the October 2023 XDR release, Palo Alto have introduced a new feature that identifies those profiles which has the modules to be either in "Report" or "Disabled" mode. It is kind of a warning or a notification stating that the endpoints which are reporting to these profiles might be at risk as their modules are in report or disabled mode.

Reference: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Release-Notes/October-2023

Ignore this notification if the mode of action of the listed policies is set as you intend.
At present, there is no method to eliminate the notification.

Please mark the response as "Accept as Solution" if it answers/help your question.